coinbasetransactionguide[.]blogspot[.]com

Analysis indicates that coinbasetransactionguide.blogspot.com is an active brand impersonation domain targeting Coinbase users. The domain, hosted on Blogger infrastructure, presents itself under the page title 'Coinbase Stuck Transaction Help,' suggesting it is designed to deceive users seeking assistance with cryptocurrency transactions. Infrastructure analysis reveals the domain resolves to 142.250.186.65, an IP address assigned to Google LLC (AS15169) in Germany, and uses Google nameservers (ns1.google.com to ns4.google.com). The SSL certificate is issued by Google Trust Services, which aligns with the hosting provider but does not mitigate the malicious intent. The domain was created on July 31, 2000, though this date likely reflects the registration of the underlying Blogspot platform rather than the specific malicious page. Technologies detected include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, which are consistent with legitimate Blogger-hosted sites but do not preclude malicious use. The domain is flagged by 10 of 95 security vendors on VirusTotal and appears on one security blocklist, with a Gridinsoft trust score of 0/100, further supporting its classification as a high-risk crypto scam. Defenders should treat this domain as active and malicious, particularly given its explicit targeting of Coinbase users. The use of a well-known hosting provider complicates takedown efforts, but monitoring for similar Blogger-hosted pages with comparable naming conventions (e.g., transaction help, support, or recovery themes) may help identify related threats. No evidence of a broader phishing kit or additional infrastructure is present in the current data, but the domain remains a credible threat for credential harvesting or fraudulent transaction facilitation.